CyberRota Analysis
AI-GeneratedGrafana Enterprise instances with IdP-initiated SAML login enabled are vulnerable due to the SAML library's failure to validate the InResponseTo field, which compromises anti-replay protection. This flaw allows an attacker to replay a valid signed SAML assertion, potentially granting unauthorized access to the victim's session. Organizations using Grafana Enterprise with this setting enabled should prioritize remediation to mitigate the risk of unauthorized access.
Original NVD Description
When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.